The CBC-MAC integrity functions in the nCipher nCore API before 2.18 transmit the initialization vector IV as part of a message when the implementation uses a non-zero IV, which allows remote attackers to bypass integrity checks and modify messages without being detected.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ncore | Ncipher | 2.17 (including) | 2.17 (including) |